The Amy Boyer Case

Resmburg v. Docusearch

"It's actually obsene [sic] what you can find out about people on the Internet."

--Liam Youens, the man who used Docusearch to locate and kill Amy Boyer.

Case History | Law | Legal Materials | News and Resources

Top News

• NH Supreme Court: Information Sellers May Be Liable for Amy Boyer's Death. The New Hampshire Supreme Court has held that information brokers and private investigators can be liable for the harms caused by selling personal information. In the case, a young woman was murdered by a stalker who obtained her personal information from information brokers and private investigators. EPIC submitted an amicus brief in the case supporting greater privacy protections against pretextual calling and the sale of Social Security Numbers. (Feb. 18, 2003)

Case History

On July 29, 1999, Liam Youens contacted Docusearch, an internet-based investigation and information service, and requested the date of birth of Amy Lynn Boyer, a woman Youens had been obsessed with since the two attended high school together. Youens later contacted Docusearch to request Boyer's social security number (SSN) and employment information. Docusearch was unable to provide Boyer's date of birth, but obtained her SSN from a credit reporting agency as part of a credit header and provided it to Youens for $45.

Docusearch obtained Boyer's work address by having a subcontractor, Michelle Gambino, place a "pretext" call to Boyer. Gambino lied about who she was and the purpose of her call in order to convince Boyer to reveal her employment information--Gambino pretended to be affiliated with Boyer's insurance company, and requested "verification" of Boyer's work address in order to facilitate an overpayment refund. Docusearch charged Youens $109 for this information.

On October 15, 1999, Youens drove to Boyer's workplace and fatally shot her as she left work. He then committed suicide. A subsequent police investigation revealed that Youens kept firearms and ammunition in his bedroom, and maintained a website containing references to stalking and killing Boyer, as well as detailing plans to murder her entire family.

Amy Boyer's mother sued Docusearch and the individual private investigators that worked with Youens for wrongful death; invasion of privacy through intrusion upon seclusion; invasion of privacy through commercial appropriation of private information; violation of the Fair Credit Reporting Act; and violation of the New Hampshire Consumer Protection Act. EPIC submitted an amicus brief arguing that Docusearch should be liable under all claims.

Pretexting

Pretexting is the practice of collecting information about a person using false pretenses. Typically, investigators pretext by calling family members or coworkers of the victim under the pretense of some official purpose. This can include calls made under the pretense that the victim is about to receive a sweepstakes award or insurance payment. The family members or coworkers called are deceived by the pretexter, and provide personal information on the victim.

Certain types of pretexting were prohibited by a 1999 law (the Financial Services Modernization Act, which is also known as the Gramm-Leach-Bliley Act or GLBA). The GLBA prohibits pretext calls made to financial, brokerage, or insurance companies. But investigators still can call friends, relatives, or entities not covered by the GLBA under false pretenses in order to gain information on the victim.

For more information on pretexting, see EPIC's Gender and Electronic Privacy Page.

Law

Tort Claims

Wrongful Death. A successful wrongful death claim requires breach of a duty owed to the victim by the defendant, resulting in the wrongful death. Specifically, it would require that Docusearch owe a duty to Amy Boyer not to disclose her private, sensitive, personal information for other than legitimate purposes without her knowledge or consent. Amy Boyer's estate alleges that Docusearch reasonably should have known of the potential danger to Amy Boyer of its unauthorized disclosure of her personal information to Youens.

Invasion of Privacy Claims. Invasion of Privacy torts require that the plaintiff have a "reasonable expectation of privacy" in the information in question, and that the invasion by the defendant have caused harm.

Intrusion Upon Seclusion. Intrusion upon seclusion occurs where there is an invasion, through conduct offensive to an ordinary person, of an individual's information in which she has a "reasonable expectation of privacy." Amy Boyer's estate argues that she had a reasonable expectation of privacy in her address and social security number, and that Docusearch's action in indiscriminately releasing this information was reasonably offensive.

Commercial Appropriation of Private Information. The tort of commercial appropriation protects the "inherent right of every human being to control the commercial use of his or her identity." J. Thomas McCarthy, The Rights of Publicity and Privacy, § 1.2, 1-8 (1992). Currently, sixteen states recognize a common law cause of action for commercial appropriation of name, likeness, performance, or identity, and twelve other states have enacted comparable statutory protections instead of or in addition to recognizing the tort. The New Hampshire Supreme Court--which has not yet recognized this tort--has the discretion to recognize a cause of action for commercial appropriation. Amy Boyer's estate argues that Amy Boyer was entitled to exclusive use and control of her name and identifying characteristics, and the right to prohibit the commercial use of this information by others.

Statutory Claims

Violation of the Fair Credit Reporting Act. The FCRA places restrictions on the compilation and release of consumer reports by consumer reporting agency. A consumer reporting agency cannot furnish a consumer report--except in limited, inapplicable circumstances--without the approval of or disclosure to the consumer. In particular, a credit reporting agency cannot furnish a report to persons other than those with a "legitimate business purpose," and a person cannot obtain a consumer report from a consumer reporting agency for resale without disclosing the identity and purpose of the end-user, and certifying that the report will be used only for a legitimate purpose. Amy Boyer's estate alleges that Docusearch willfully or negligently procured and disclosed the consumer credit information--including the SSN--of Amy Boyer, without providing notice to Amy Boyer or verifying the identity or purpose of Youens.

Violation of the New Hampshire Consumer Protection Act. The New Hampshire Consumer Protection Act protects individuals from "any unfair method of competition or any unfair or deceptive act or practice in the conduct of any trade or commerce within [New Hampshire]." N.H. Rev. Stat. Ann. § 358-A:2 (2002). Amy Boyer's estate alleges that the practice of pretexting engaged in by Docusearch to obtain information by deception and provide private information to outside parties for a fee constituted an unfair and deceptive act under the CPA.

Legal Materials

• EPIC's Amicus Brief
• New Hampshire Consumer Protection Act
• Relevant section of the Fair Credit Reporting Act

News and Resources

• Reproduction of Liam Youen's Amy Boyer website (mirrored on the day he died) (via Archive.org)
• Amy Boyer's dedication website (created by her parents) (via Archive.org)
• Your Rights Online: Interesting Privacy Decision in New Hampshire, Slashdot, February 18, 2003.
• New Hampshire Supreme Court Rules in Amy Boyer Privacy Case, Declan McCullagh's Politechbot.com, February 18, 2003.
• Court: Information Brokers Can Be Liable, DMNews, February 19, 2003.
• Slain Woman's Kin Fight Internet Brokers, New York Times, December 29, 2002.

Last Updated: June 15, 2006
Page URL: http://www.epic.org/privacy/boyer/default.html